feat: Add tool for getting host /etc/resolv.conf

Bug: 311652459
Change-Id: I99238200bb27ffc16c6fee7e3ce7080a3f3a44c2
GitOrigin-RevId: 4f8952399815d0900f93d935c96895e81663fb11

Author: Privacy Sandbox Team

scp/cc/aws/proxy/readme.md

@@ -78,7 +78,9 @@ If you'd like to try out this proxy with your own application, follow these step
    unlinks it and creates a new one with pre-defined content that defines the nameservers to 8.8.8.8
    and 1.1.1.1. This will make the enclave application talk to these servers during DNS resolution.
    It may not work in a private VPC without internet access. You may need to override the
-   `/etc/resolv.conf` inside the enclave with your desired private DNS settings.
+   `/etc/resolv.conf` inside the enclave with your desired private DNS settings. To use the host DNS
+   settings within the enclave, run `./resolv_conf_getter_server &` on the host outside the enclave;
+   Then run `/proxify /resolv_conf_getter_client` inside the enclave.
 1. AmazonLinux2 (AL2) uses an old version of glibc. Newer compilers with newer glibc on your build
    machine may generate binary that's not runnable on AL2. That's why we created
    `//scp/cc/aws/proxy:reproducible_proxy_outputs` target to generate binaries that's guaranteed

scp/cc/aws/proxy/src/BUILD.bazel

@@ -21,13 +21,62 @@
     doesn't have std::filesystem, instead it's in std::experimental
 """
 
+load("@com_github_grpc_grpc//bazel:grpc_build_system.bzl", "grpc_proto_library")
 load("@io_bazel_rules_docker//container:container.bzl", "container_image", "container_layer")
+load("@rules_buf//buf:defs.bzl", "buf_lint_test")
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files")
 load("@rules_pkg//pkg:pkg.bzl", "pkg_tar")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 package(default_visibility = ["//scp/cc/aws/proxy/test:__subpackages__"])
 
+cc_binary(
+    name = "resolv_conf_getter_client",
+    srcs = ["resolv_conf_getter_client.cc"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":resolv_conf_getter_grpc",
+        "//scp/cc:cc_base_include_dir",
+        "@com_github_grpc_grpc//:grpc++",
+        "@com_google_absl//absl/flags:flag",
+        "@com_google_absl//absl/flags:parse",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_binary(
+    name = "resolv_conf_getter_server",
+    srcs = ["resolv_conf_getter_server.cc"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":resolv_conf_getter_grpc",
+        "//scp/cc:cc_base_include_dir",
+        "@com_github_grpc_grpc//:grpc++",
+        "@com_google_absl//absl/flags:flag",
+        "@com_google_absl//absl/flags:parse",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+proto_library(
+    name = "resolv_conf_getter_proto",
+    srcs = ["resolv_conf_getter.proto"],
+)
+
+grpc_proto_library(
+    name = "resolv_conf_getter_grpc",
+    srcs = ["resolv_conf_getter.proto"],
+)
+
+buf_lint_test(
+    name = "resolv_conf_getter_proto_lint",
+    size = "small",
+    config = "//scp:buf.yaml",
+    targets = [":resolv_conf_getter_proto"],
+)
+
 cc_library(
     name = "acceptor_pool",
     hdrs = ["acceptor_pool.h"],
@@ -297,6 +346,7 @@ pkg_files(
     name = "proxify_executables",
     srcs = [
         "//scp/cc/aws/proxy/src:proxify",
+        "//scp/cc/aws/proxy/src:resolv_conf_getter_client",
         "//scp/cc/aws/proxy/src:socket_vendor",
     ],
     attributes = pkg_attributes(mode = "0555"),

scp/cc/aws/proxy/src/resolv_conf_getter.proto

@@ -0,0 +1,27 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package privacy_sandbox.server_common;
+
+service ResolvConfGetterService {
+  rpc GetResolvConf(GetResolvConfRequest) returns (GetResolvConfResponse) {}
+}
+
+message GetResolvConfRequest {}
+
+message GetResolvConfResponse {
+  string content = 1;
+}

scp/cc/aws/proxy/src/resolv_conf_getter_client.cc

@@ -0,0 +1,88 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <fstream>
+#include <iostream>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include <grpcpp/channel.h>
+#include <grpcpp/client_context.h>
+#include <grpcpp/create_channel.h>
+#include <grpcpp/security/credentials.h>
+
+#include "absl/flags/flag.h"
+#include "absl/flags/parse.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
+#include "aws/proxy/src/resolv_conf_getter.grpc.pb.h"
+
+ABSL_FLAG(int, port, 1600, "Port on which client and server communicate.");
+
+namespace {
+
+using privacy_sandbox::server_common::GetResolvConfRequest;
+using privacy_sandbox::server_common::GetResolvConfResponse;
+using privacy_sandbox::server_common::ResolvConfGetterService;
+
+class Client {
+ public:
+  explicit Client(std::shared_ptr<grpc::Channel> channel)
+      : stub_(ResolvConfGetterService::NewStub(std::move(channel))) {}
+
+  absl::StatusOr<std::string> GetResolvConf() {
+    grpc::ClientContext context;
+    GetResolvConfResponse response;
+    GetResolvConfRequest request;
+    if (grpc::Status status =
+            stub_->GetResolvConf(&context, request, &response);
+        !status.ok()) {
+      const grpc::StatusCode grpc_code = status.error_code();
+      const absl::StatusCode absl_code = (grpc_code != grpc::DO_NOT_USE)
+                                             ? absl::StatusCode(grpc_code)
+                                             : absl::StatusCode::kUnknown;
+      return absl::Status(absl_code, std::move(status).error_message());
+    }
+    return response.content();
+  }
+
+ private:
+  std::unique_ptr<ResolvConfGetterService::Stub> stub_;
+};
+
+}  // namespace
+
+int main(int argc, char** argv) {
+  absl::ParseCommandLine(argc, argv);
+  Client client(
+      grpc::CreateChannel(absl::StrCat("localhost:", absl::GetFlag(FLAGS_port)),
+                          grpc::InsecureChannelCredentials()));
+  const absl::StatusOr<std::string> content = client.GetResolvConf();
+  if (!content.ok()) {
+    std::cerr << content.status() << std::endl;
+    return -1;
+  }
+  std::ofstream ofs("/etc/resolv.conf");
+  ofs << R"resolv(
+; BEGIN Enclave configuration.
+; These lines are added by `resolv_conf_getter_client`.
+; use-vc forces use of TCP for DNS resolutions.
+; See https://man7.org/linux/man-pages/man5/resolv.conf.5.html
+options use-vc timeout:2 attempts:5
+; END Enclave configuration.
+)resolv";
+  ofs << *content;
+}

scp/cc/aws/proxy/src/resolv_conf_getter_server.cc

@@ -0,0 +1,66 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <fstream>
+#include <iostream>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+
+#include <grpcpp/security/server_credentials.h>
+#include <grpcpp/server.h>
+#include <grpcpp/server_builder.h>
+#include <grpcpp/server_context.h>
+
+#include "absl/flags/flag.h"
+#include "absl/flags/parse.h"
+#include "absl/strings/str_cat.h"
+#include "aws/proxy/src/resolv_conf_getter.grpc.pb.h"
+
+ABSL_FLAG(int, port, 1600, "Port on which client and server communicate.");
+
+namespace {
+
+using privacy_sandbox::server_common::GetResolvConfRequest;
+using privacy_sandbox::server_common::GetResolvConfResponse;
+using privacy_sandbox::server_common::ResolvConfGetterService;
+
+class ResolvConfGetterImpl final : public ResolvConfGetterService::Service {
+ public:
+  grpc::Status GetResolvConf(grpc::ServerContext* /*context*/,
+                             const GetResolvConfRequest* /*request*/,
+                             GetResolvConfResponse* response) {
+    std::ifstream ifs("/etc/resolv.conf");
+    response->mutable_content()->assign((std::istreambuf_iterator<char>(ifs)),
+                                        (std::istreambuf_iterator<char>()));
+    return grpc::Status::OK;
+  }
+};
+
+}  // namespace
+
+int main(int argc, char** argv) {
+  absl::ParseCommandLine(argc, argv);
+  const std::string server_address =
+      absl::StrCat("localhost:", absl::GetFlag(FLAGS_port));
+  ResolvConfGetterImpl service;
+
+  grpc::ServerBuilder builder;
+  builder.AddListeningPort(server_address, grpc::InsecureServerCredentials());
+  builder.RegisterService(&service);
+  std::unique_ptr<grpc::Server> server(builder.BuildAndStart());
+  std::cout << "Server listening on " << server_address << std::endl;
+  server->Wait();
+}

scp/cc/aws/proxy/test/BUILD.bazel

@@ -90,6 +90,20 @@ sh_test(
     ],
 )
 
+sh_test(
+    name = "resolv_conf_getter_test",
+    size = "small",
+    srcs = ["resolv_conf_getter_test_app"],
+    args = [
+        "$(location //scp/cc/aws/proxy/src:resolv_conf_getter_client)",
+        "$(location //scp/cc/aws/proxy/src:resolv_conf_getter_server)",
+    ],
+    data = [
+        "//scp/cc/aws/proxy/src:resolv_conf_getter_client",
+        "//scp/cc/aws/proxy/src:resolv_conf_getter_server",
+    ],
+)
+
 sh_test(
     name = "preload_exported_symbols_test",
     size = "small",

scp/cc/aws/proxy/test/resolv_conf_getter_test_app

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+readonly client_path="$1"
+readonly server_path="$2"
+
+if ! [[ -x ${client_path} ]]; then
+  printf "client: %s is not accessible\n" "${client_path}" &> /dev/stderr
+  exit 1
+fi
+
+if ! [[ -x ${server_path} ]]; then
+  printf "server: %s is not accessible\n" "${server_path}" &> /dev/stderr
+  exit 1
+fi
+
+# Run the server, get pid.
+"${server_path}" &
+declare -i -r server_pid=$!
+function _cleanup() {
+  local -r -i STATUS=$?
+  if [[ -v server_pid ]]; then
+    kill ${server_pid}
+  fi
+  exit ${STATUS}
+}
+trap _cleanup EXIT
+sleep 1
+
+"${client_path}"
+declare -i NS_COUNT
+NS_COUNT=$(grep -cw ^nameserver /etc/resolv.conf)
+if [[ ${NS_COUNT} -eq 0 ]]; then
+  printf "resolv.conf contains no nameserver entries\n"
+  exit 1
+fi